How geek listen to 903

Since it is quite troublesome to locate and click an icon or type the link with a browser everyday.

It should be expected that when geek need to listen to the only local radio that Hong Kong have, he will just type “903” to achieve it.

Here we go:

alias 903='ffplay rtsp:// -nodisp'

“The finding was attached as below:”

read more

Git Reference

Setup self-hosted git remote repository

Git deployment workflow between local, remote repository and web server

Git deployment workflow between development and live/production on the same server

Sync project to repo brainlessly… alias sync=”git add . && git commit -m “changed” && git push”

read more

Web security assessment check list. (Black box)

There are several things we gonna check on building a secure web page. Assumed that the assessment is done on black box. Here we included some steps and procedures for a simple analysis on a web page. The following is from 2010, it take no reference from SANS and OWASP’s checklist, but it contains what comes up my mind at the moment I post.

  1. Check the machine location and route. Is it only accessible through internal network or publicly reachable (Exclude mainland)? Is it behind a low balancer and firewall? Is it located on a distributed network or member of the cloud? Any fingerprint from whois/netcraft?

  2. Check the machine type. Is there any other services running beside port 80 and 443? Scanner like nmap/nessus may help. What OS and server is the machine running? Apache/IIS/WebSphere/Tomcat…? What version is it?

  3. Check the purpose of the web server. Is it a dynamic website with user involvement? Is there a database behind? What version will the database properly be, according to the httpd server? MySQL/Oracle/DB2/… Say if it is running apache most likely it work with LAMP. And if windows is the host, it may have IIS, ASP, Access, IIS database manager… or still WAMP. Will this server further connect to other internal computer for retrieving contents? What are the host properly behind? (You may know it from jobsdb or make a phone call to their datacenter :)

    read more

Greeting according to different location (IP)

Imagine when you carry your own notebook to do assessment in different client sites. You would like to run several scripts and have to put different configuration files for different sites. I found its quite useful when you can notify to yourself what IP you current have and change your working directory to certain folder. Here is the script to put in the ~/.profile when you are using a Mac

#Check if I am at office
networksetup -getinfo Wi-Fi| grep -x "Router:" > /dev/null && cd /Users/anony/Documents/work && \
toilet -f mono12 -F metal Office

You can obtain the “toilet” program by “sudo port install toilet” in Mac. Here is the result when I am in Office with IP

read more